medium6.3
CVE-2025-47271
OZI-Project/ozi-publish Code Injection vulnerability
Impact
### Impact Potentially untrusted data flows into PR creation logic. A malicious actor could construct a branch name that injects arbitrary code. ### Patches This is patched in 1.13.6 ### Workarounds Downgrade to <1.13.2 ### References * [Understanding the Risk of Script Injections](https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#understanding-the-risk-of-script-injections)
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| actions | OZI-Project/publish | >= 1.13.2, < 1.13.6 | 1.13.6 |
Affected products
| Product | Affected versions |
|---|---|
| Versions 1.13.2 | through 1.13.5 |
Versions were read from the advisory text. No structured product data has been published for this record yet.